opencode-swarm 7.188.9 → 7.188.10

package/dist/lang/backend.d.ts

@@ -36,6 +36,13 @@ export interface TestFrameworkSelection {
      * cannot avoid a shell-mediated invocation (e.g. PowerShell `-EncodedCommand`)
      * still produce an array; the array's first element is the binary and the
      * rest are individual arguments.
+     *
+     * On win32 an array whose `argv[0]` is a `cmd.exe` contained-launcher tuple
+     * (from `resolveContainedWindowsBatchCommand`) additionally requires the
+     * spawner to pass `windowsVerbatimArguments: true`, so the pre-quoted tail
+     * reaches cmd.exe unmodified. A caller spawning a Windows wrapper this way
+     * must gate on `isWindowsCommandInterpreterLaunch(cmd)`;
+     * `src/tools/test-runner.ts` is the reference implementation.
      */
     cmd: string[];
     /** Explicit cwd for the spawn (invariant 3). */

package/dist/lang/default-backend.d.ts

@@ -49,6 +49,31 @@ export declare function defaultSelectTestFramework(profile: LanguageProfile, dir
  * (`SWARM_LANG_BACKEND=legacy`) switch so both routes emit identical argv.
  */
 export declare function buildGradleTestCommand(dir: string, targets?: string[]): string[];
+/**
+ * Build the argv for a Composer `vendor/bin` tool (`phpunit`, `pest`) for `dir`
+ * (issue #3050).
+ *
+ * On win32 a Composer `.bat` shim must never become a raw spawn target: Node's
+ * `child_process.spawn` rejects a batch file outright (EINVAL), and although
+ * Bun tolerates one, that tolerance is a runtime accident rather than a
+ * contract, so behaviour must not depend on which runtime is hosting the
+ * plugin. Route the wrapper through the contained cmd.exe launcher
+ * (`resolveContainedWindowsBatchCommand`), the same path the Maven (#3021) and
+ * Gradle (#3040) wrappers already take.
+ *
+ * When the launcher declines — no shim present, a symlink escaping `dir`, an
+ * unresolvable `ComSpec`, or an argument carrying a cmd.exe metacharacter — the
+ * fallback runs the PHP interpreter against the extensionless Composer proxy
+ * rather than re-emitting the batch file. Composer writes both, the proxy is
+ * what the `.bat` itself invokes, and the `php-artisan` arm of the very same
+ * switch already hardcodes `php`.
+ *
+ * Non-win32 is unchanged: the historical cwd-relative extensionless proxy.
+ * Shared by `defaultBuildTestCommand`, the test-runner's legacy
+ * (`SWARM_LANG_BACKEND=legacy`) switch, and the PHP backend's
+ * `selectTestFramework`, so all three routes emit identical argv.
+ */
+export declare function buildPhpVendorCommand(dir: string, name: string, args?: string[]): string[];
 export declare function defaultBuildTestCommand(profile: LanguageProfile, framework: string, files: string[], dir?: string, opts?: BuildTestCommandOpts): string[] | null;
 export declare function buildNativeTargetCommand(target: NativeTestTarget): string[];
 /**

package/dist/tools/build-check.d.ts

@@ -37,6 +37,19 @@ export interface BuildRun {
     duration_ms: number;
     stdout_tail: string;
     stderr_tail: string;
+    /**
+     * Set only when the process could not be created at all — the `bunSpawn`
+     * `spawnError` value contract (`src/utils/bun-compat.ts`), which is how
+     * process-creation failures surface on every runtime.
+     *
+     * Without it a launch failure is indistinguishable from a build that ran and
+     * exited non-zero: `spawnError` and `exitCode` are mutually exclusive, so a
+     * failed spawn resolves `exited` to the sentinel 1 and this record would read
+     * "exit 1" either way (issue #3050). Absent — not null — when the process did
+     * start, so "no launch failure" stays distinguishable from "field present but
+     * empty".
+     */
+    spawn_error?: string;
 }
 export interface BuildCheckResult {
     verdict: EvidenceVerdict;

package/dist/utils/windows-batch.d.ts

@@ -2,10 +2,15 @@
  * Safe launch of a Windows batch wrapper (`.cmd` / `.bat`) through a
  * validated `cmd.exe`.
  *
- * Node and Bun cannot spawn a batch file directly (EINVAL since the
- * CVE-2024-27980 hardening), and a bare wrapper name such as `mvnw.cmd` is
- * resolved against PATH only — never against the spawn `cwd`. The supported
- * shape is `[<cmd.exe>, '/d', '/s', '/v:off', '/c', 'call "<abs>" "<arg>" ...']`
+ * Node cannot spawn a batch file directly at all: since the CVE-2024-27980
+ * hardening `child_process.spawn` rejects a `.cmd`/`.bat` target with EINVAL
+ * (measured on Node v24.16.0 for the absolute, cwd-relative and bare-name
+ * forms alike). Bun is more permissive — it routes batch files through cmd.exe
+ * itself — but that tolerance is a runtime accident rather than a contract, so
+ * a launcher must not depend on which runtime hosts the plugin. For the same
+ * reason a bare wrapper name such as `mvnw.cmd` is resolved against PATH only,
+ * never against the spawn `cwd`. The supported shape is
+ * `[<cmd.exe>, '/d', '/s', '/v:off', '/c', 'call "<abs>" "<arg>" ...']`
  * spawned with `windowsVerbatimArguments: true`, so the pre-quoted tail reaches
  * cmd.exe unmodified (the same pattern `src/tools/lint.ts` and
  * `src/tools/pkg-audit.ts` use).

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "opencode-swarm",
-	"version": "7.188.9",
+	"version": "7.188.10",
 	"description": "Architect-centric agentic swarm plugin for OpenCode - hub-and-spoke orchestration with SME consultation, code generation, and QA review",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",